27
Mobile Malware Defense and possibly Anti-Forensics Sheran A. Gunasekera <[email protected] > IDSECCONF 2013, Surabaya, Indonesia 1

Mobile Malware defense and possibly Anti-forensics

Embed Size (px)

DESCRIPTION

Mobile Malware defense and possibly Anti-forensics - Sheran Gunasekera

Citation preview

Page 1: Mobile Malware defense and possibly Anti-forensics

Mobile Malware Defense

and possibly Anti-Forensics

Sheran A. Gunasekera <[email protected]>

IDSECCONF 2013, Surabaya, Indonesia1

mailto:[email protected]
mailto:[email protected]
Page 2: Mobile Malware defense and possibly Anti-forensics

Digital forensics - Analyzing & gathering evidence of incidents occurring on a digital device

Malware - Malicious software designed to disrupt or collect sensitive information from digital devices

2

Page 3: Mobile Malware defense and possibly Anti-forensics

In 2011, we saw unprecedented growth of mobile malware attacks with a 155 percent increase across all platforms. -- Daniel Hoffman (Juniper)

Malware

3

Page 4: Mobile Malware defense and possibly Anti-forensics

DetectionSignature based?

Unique characteristics

No signature, no detection

4

Page 5: Mobile Malware defense and possibly Anti-forensics

In 2012, 45 percent of the AV signatures failed to detect malware that used such basic transformation techniques -- Dark Reading Article [April 2013]

ACME Malware Detector

Malware Signatures

5

Page 6: Mobile Malware defense and possibly Anti-forensics

PWN3DAssume you’ve been infected

Helps you stay paranoid

6

Page 7: Mobile Malware defense and possibly Anti-forensics

ActorsYou

Your Mobile Device

The guy spying on you

7

Page 8: Mobile Malware defense and possibly Anti-forensics

Inbound & outbound email

Inbound & outbound SMS/MMS

Phone Call Logs

BBM Messages

Contact information

How does it work?

8

Page 9: Mobile Malware defense and possibly Anti-forensics

Crippling Malware

Relies on ex!ltrated data

Expects data to be accurate

But what if the data wasn’t accurate...?

9

Page 10: Mobile Malware defense and possibly Anti-forensics

Techniques

DDTS - Don’t Drop The Soap *

POEPFlood - Phony Object Escalation Process

FML - Flush My Log *

* Can be used for Anti-forensics

10

Page 11: Mobile Malware defense and possibly Anti-forensics

DDTS

Possible use for Anti-Forensics

Works on USB trigger

Use IOPortListener or USBPortListener

Trigger on event connectionRequested()

11

Page 12: Mobile Malware defense and possibly Anti-forensics

USB Connection •Flood Email•Flood SMS•Flood Contact•Flush Log

12

Page 13: Mobile Malware defense and possibly Anti-forensics

Hooking emailEmail Messages

Package: net.rim.blackberry.api.mail.event

Interface: FolderListener

Methods: messagesAdded()

- Intercept and forward all emails on the BlackBerry handheld

13

Page 14: Mobile Malware defense and possibly Anti-forensics

Listener

14

Page 15: Mobile Malware defense and possibly Anti-forensics

Listener

Flooder

15

Page 16: Mobile Malware defense and possibly Anti-forensics

16

Page 17: Mobile Malware defense and possibly Anti-forensics

Hooking Call Logs

17

Page 18: Mobile Malware defense and possibly Anti-forensics

Hooking Call Logs

18

Page 19: Mobile Malware defense and possibly Anti-forensics

Contact Flooder

Contact 1Contact 2Contact 3Contact 4

19

Page 20: Mobile Malware defense and possibly Anti-forensics

A note about keywordsFake email only as good as keywords

Build an algorithm to mine existing keywords

Think like the person that spies on you

If they search for “bank”,”password”,”pin”...

20

Page 21: Mobile Malware defense and possibly Anti-forensics

Log Files

Event LogLog Entry 1

Log Entry 2

Log Entry3

Log Entry n-2

Log Entry n-1

Log Entry n

...

16Kb Log Size

New entries written to the bottom

Old entries are ejected

21

Page 22: Mobile Malware defense and possibly Anti-forensics

FML

Event LogLog Entry 1

Crap

Crap

Crap

Crap

Crap

...

16Kb Log Size

FMLog attackwrites

fake data

Valid Entries are deleted

22

Page 23: Mobile Malware defense and possibly Anti-forensics

FML

BlackBerry Log Size - 16kb

Android LogCat size - 64kb

23

Page 24: Mobile Malware defense and possibly Anti-forensics

Why?

24

Page 25: Mobile Malware defense and possibly Anti-forensics

Why?

Unorthodox

Good wing-man for conventional

Frustrates the guy spying on you

25

Page 26: Mobile Malware defense and possibly Anti-forensics

Recap

• Assume you’re pwn3d

• Introduce controlled “noise” in your data

• Make it harder for the guy spying on us

• Sit back and laugh

26

Page 27: Mobile Malware defense and possibly Anti-forensics

Thanks

[email protected]

http://chirashi.zensay.com

@chopstick_

27

mailto:[email protected]
mailto:[email protected]
http://chirashi.zensay.com
http://chirashi.zensay.com

Malware: Scanners, Sniffers, Viruses, Worms, Mobile Code COEN 252 / 152: Computer Forensics

Malware: Scanners, Sniffers, Viruses, Worms, Mobile Code COEN 252 / 152: Computer Forensics

Documents
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
Practical Reversing III – Malware Memory Forensics

Practical Reversing III – Malware Memory Forensics

Documents
Memory Forensics & Security Analytics: Detecting Unknown ... · Memory Forensics & Security Analytics: Detecting Unknown Malware ... Any malware that is not detected by traditional

Memory Forensics & Security Analytics: Detecting Unknown ... · Memory Forensics & Security Analytics: Detecting Unknown Malware ... Any malware that is not detected by traditional

Documents
Hunting Mac Malware with Memory Forensics

Hunting Mac Malware with Memory Forensics

Technology
Reverse Engineering Mac Malware - Digital Forensics … · Reverse Engineering Mac Malware SANS DFIR Summit 06/09/14 Sarah Edwards @iamevltwin mac4n6.com

Reverse Engineering Mac Malware - Digital Forensics … · Reverse Engineering Mac Malware SANS DFIR Summit 06/09/14 Sarah Edwards @iamevltwin mac4n6.com

Documents
Malware Incident Handling & Forensics. Malware Types Viruses. A virus self-replicates by inserting copies of itself into host programs or data files

Malware Incident Handling & Forensics. Malware Types Viruses. A virus self-replicates by inserting copies of itself into host programs or data files

Documents
Detecting Malware With Memory Forensics - Deer Run

Detecting Malware With Memory Forensics - Deer Run

Documents
Few Malware Anti- Forensics e. Techniques - · PDF fileFew Malware Anti-Forensics Techniques H2HC University 2016 By Alexandre Borges 1 es – e

Few Malware Anti- Forensics e. Techniques - · PDF fileFew Malware Anti-Forensics Techniques H2HC University 2016 By Alexandre Borges 1 es – e

Documents
Malware Forensics Field Guide for Linux Systems: … Forensics Field... · Chapter | 3 ostmortem Forensics 165 u The hard drive of a Linux computer can contain traces of malware in

Malware Forensics Field Guide for Linux Systems: … Forensics Field... · Chapter | 3 ostmortem Forensics 165 u The hard drive of a Linux computer can contain traces of malware in

Documents
Reverse Engineering Mac Malware - SANS · PDF fileReverse Engineering Mac Malware SANS DFIR Summit ... Mobile, Malware, ... General Forensics Nerd & Mac Fan Girl

Reverse Engineering Mac Malware - SANS · PDF fileReverse Engineering Mac Malware SANS DFIR Summit ... Mobile, Malware, ... General Forensics Nerd & Mac Fan Girl

Documents
Malware Forensics Field Guide for Linux Systems: Digital Forensics …cdn.ttgtmedia.com/rms/security/Malware Forensics Field... · 2014-09-02 · 164 MALWARE FORENSICS FIELD GUIDE

Malware Forensics Field Guide for Linux Systems: Digital Forensics …cdn.ttgtmedia.com/rms/security/Malware Forensics Field... · 2014-09-02 · 164 MALWARE FORENSICS FIELD GUIDE

Documents
Android Malware Forensics: What It Does and How to Find It · PDF filemobile devices as well. At this time, the forensics community is at a benefit in that Android malware and other

Android Malware Forensics: What It Does and How to Find It · PDF filemobile devices as well. At this time, the forensics community is at a benefit in that Android malware and other

Documents
Mobile security, forensics & malware analysis with …2013.appsecusa.org/2013/wp-content/uploads/2013/12/viaForensics... · Mobile security, forensics & malware analysis with Santoku

Mobile security, forensics & malware analysis with …2013.appsecusa.org/2013/wp-content/uploads/2013/12/viaForensics... · Mobile security, forensics & malware analysis with Santoku

Documents
Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

Documents
Detecting Malware With Memory Forensicshal/Detect_Malware_w_Memory_Forensics.pdfDetecting Malware With Memory Forensics Hal Pomeranz SANS Institute . Why Memory Forensics? Everything

Detecting Malware With Memory Forensicshal/Detect_Malware_w_Memory_Forensics.pdfDetecting Malware With Memory Forensics Hal Pomeranz SANS Institute . Why Memory Forensics? Everything

Documents
Malware Analysis - iswatlab.eu · Malware Sample Gather intelligence from reports and IOCs Basic Static Analysis Dynamic Analysis Forensics Report Delivery Advanced Analysis Sandbox

Malware Analysis - iswatlab.eu · Malware Sample Gather intelligence from reports and IOCs Basic Static Analysis Dynamic Analysis Forensics Report Delivery Advanced Analysis Sandbox

Documents
Christian Wojner, CERT - FIRST · Wh01am 02.04.2013 2 Person Christian Wojner Malware Analysis, Reverse Engineering, Computer Forensics CERT.at / GovCERT.gv.at Papers Mass Malware

Christian Wojner, CERT - FIRST · Wh01am 02.04.2013 2 Person Christian Wojner Malware Analysis, Reverse Engineering, Computer Forensics CERT.at / GovCERT.gv.at Papers Mass Malware

Documents
Advanced malware analysis training session 7 malware memory forensics

Advanced malware analysis training session 7 malware memory forensics

Technology
Tools and techniques for cleaning malware incidents · Tools and techniques for cleaning malware incidents Martin Overton – IBM Security Services Malware/Anti-Malware SME, Forensics,

Tools and techniques for cleaning malware incidents · Tools and techniques for cleaning malware incidents Martin Overton – IBM Security Services Malware/Anti-Malware SME, Forensics,

Documents
clarity · or malware incident, the direct costs of forensics and investigation. Because of the additional cost of forensics and investigations associated with hack and malware incidents,

clarity · or malware incident, the direct costs of forensics and investigation. Because of the additional cost of forensics and investigations associated with hack and malware incidents,

Documents
Basic Static Malware Analysis using open source tools · PDF fileBasic Static Malware Analysis using open source tools ... Malware Analysis Unit, Digital Forensics CoE, ... From mobile

Basic Static Malware Analysis using open source tools · PDF fileBasic Static Malware Analysis using open source tools ... Malware Analysis Unit, Digital Forensics CoE, ... From mobile

Documents
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics

Advanced Malware Analysis Training Session 7 - Malware Memory Forensics

Technology
Memory Forensics Malware Detection - GitHub Pagestristartom.github.io/teaching/15s-cis700/others/memanalysis.pdf · Memory Forensics Per Wikipedia, Memory forensics is forensic analysis

Memory Forensics Malware Detection - GitHub Pagestristartom.github.io/teaching/15s-cis700/others/memanalysis.pdf · Memory Forensics Per Wikipedia, Memory forensics is forensic analysis

Documents
Detecting Malware With Memory Forensics - Deer Run Associates

Detecting Malware With Memory Forensics - Deer Run Associates

Documents
Reversing & malware analysis training part 8 malware memory forensics

Reversing & malware analysis training part 8 malware memory forensics

Technology
DFRWS Forensics Challenge 2016 - CMAND · PDF fileDFRWS Forensics Challenge 2016 Robert Beverly, Brian Greunke, ... 2014 Mobile Malware 2013 Block Classifier 2012 Block Classifier

DFRWS Forensics Challenge 2016 - CMAND · PDF fileDFRWS Forensics Challenge 2016 Robert Beverly, Brian Greunke, ... 2014 Mobile Malware 2013 Block Classifier 2012 Block Classifier

Documents
Bringing Science to the Evaluation of Malware Forensics

Bringing Science to the Evaluation of Malware Forensics

Documents
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced Malware

Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced Malware

Technology
Detecting Malware With Memory Forensics - Deer Runhal/Detect_Malware_w_Memory_Forensics.pdf · 2012-10-01 · Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute

Detecting Malware With Memory Forensics - Deer Runhal/Detect_Malware_w_Memory_Forensics.pdf · 2012-10-01 · Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute

Documents